Metrics::Any::Adapter::DogStatsd versions prior to 0.04 for Perl fail to protect against metric injections, allowing an attacker to embed newline and control characters into metric streams or tags. This flaw enables the injection of arbitrary metrics or tag manipulation that can corrupt metric collection, lead to inaccurate monitoring data, or overload the monitoring system, effectively causing a denial of service on the metrics backend. The vulnerability is categorized as CWE-93, which involves improper neutralization of special elements used in a command or data input.

The affected products are PEVANS::Metrics::Any::Adapter::DogStatsd 0.01 through 0.03 and any code that uses the underlying Metrics::Any::Adapter::Statsd component with the same vulnerability. Systems that incorporate these Perl modules for sending events to DogStatsd or similar statsd extensions are at risk if they have not upgraded to version 0.04 or later.

Because no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the exact exploitation probability remains unknown. However, the attack vector is likely internal or application‑level; an attacker or malicious user who can send metrics to the vulnerable library can craft payloads containing newline and other control characters to trigger injection. The impact hinges on the availability of the metrics service and the ability to inject data, making the risk moderate to high for environments that rely on accurate monitoring for operational decisions.